LOCAL NETWORK FORENSICS
PCAP Analysis Report
Generated 2026-08-13 14:22:46 UTC
Capture filemulti-app-detection-example.pcap
Model ID: Not recorded
Packets8,823
Traffic4.97 MB
Duration53s
PlatformiOS
Capture started
Capture ended
Result 1
Blockudoku - Block Puzzle Game
com.easybrain.blockudoku100%
IOS
VERY HIGH
CLASSIFICATION MODEL TRAINING
Identified by: Apple lookup bundleId parameter
Apple lookup request exposed bundleId=com.easybrain.blockudoku
Observed network activity
2025-01-01 00:00:25 UTC
Supporting evidence
- Trusted URL identifier: bundleId=com.easybrain.blockudoku on itunes.apple.com/lookup
Result 2
DramaBox - Stream Drama Shorts
com.storymatrix.drama80%
IOS
HIGH
CLASSIFICATION MODEL TRAINING
Identified by: Classification model + capture fingerprint
The trained classification model probability was combined with similarity to reference-capture fingerprints
Observed network activity
2025-01-01 00:00:02 UTC - 2025-01-01 00:00:16 UTC
Supporting evidence
- Matched destination aws-oversea-new.ap-southeast-1.log.aliyuncs.com via dns, tls_sni
- Matched destination hwztchapter.dramaboxdb.com via tls_sni
- Matched destination sc-sa.dramaboxdb.com via tls_sni
- Matched destination deviceenrollment.v.aaplimg.com via dns
- Matched destination ocsp.apple.com via tls_sni
- Matched destination api.devicecheck.apple.com via tls_sni
- Matched destination ocsp-a.g.aaplimg.com via dns
- Matched destination alb-orfzyed48wsq1mpiwl.ap-southeast-1.alb.aliyuncsslbintl.com via dns
- 5 supporting TLS/JA4 fingerprint(s)
- 252 ordered destination marker(s) matched
- Classification model probability: 98.8%
Observed network evidence
Contacted domains
- consent.adjust.com (16 observations)
- noatt.prod.adjoe.zone (15 observations)
- hwztakavideo.dramaboxdb.com (13 observations)
- ads.inmobi.com (11 observations)
- cdn2.inner-active.mobi (11 observations)
- bag-cdn-lb.itunes-apple.com.akadns.net (10 observations)
- ep2.facebook.com (9 observations)
- app-analytics-services.com (7 observations)
- firebaselogging-pa.googleapis.com (7 observations)
- adx.ads.vungle.com (6 observations)
- api-apac.bidmachine.io (6 observations)
- api16-access-wf-sg.pangle.io (6 observations)
- gateway.unityads.unity3d.com (6 observations)
- gcs-eu-00002.content-storage-upload.googleapis.com (6 observations)
- mi.adsurge.com (6 observations)
- odf.app-ads-services.com (6 observations)
- www.inmobi.com (6 observations)
- aax-fe.amazon-adsystem.com (5 observations)
- api-liveops.easybrain.com (5 observations)
- api.bidmachine.io (5 observations)
- api16-access-ttp.tiktokpangle.us (5 observations)
- awards.easybrain.com (5 observations)
- bib.easybrain.com (5 observations)
- blockudoku.zendesk.com (5 observations)
- cdn.mobilefuse.com (5 observations)
- cfg.easybrain.com (5 observations)
- consent.easybrain.com (5 observations)
- cross-promo-provider.easybrain.com (5 observations)
- csi.gstatic.com (5 observations)
- egas.easybrain.com (5 observations)
- ets.easybrain.com (5 observations)
- googleads.g.doubleclick.net (5 observations)
- hwztvideo.dramaboxdb.com (5 observations)
- logs.ads.vungle.com (5 observations)
- mads.amazon-adsystem.com (5 observations)
- mdtb-cf-1.ads.aps.amazon-adsystem.com (5 observations)
- rcs.easybrain.com (5 observations)
- rr1---sn-oxu8pnpvo-nq8s.googlevideo.com (5 observations)
- s3-analytics-events.easybrain.com (5 observations)
- sdk-files.smaato.net (5 observations)
- sdkc.vervegroupinc.net (5 observations)
- storevalidator.easybrain.com (5 observations)
- teamrace.easybrain.com (5 observations)
- tournaments.easybrain.com (5 observations)
- up.easybrain.com (5 observations)
- wv.inner-active.mobi (5 observations)
- www.googletagservices.com (5 observations)
- www.gstatic.com (5 observations)
- ads-inmobi-comtm.trafficmanager.net (4 observations)
- amp-api-edge-lb.itunes-apple.com.akadns.net (4 observations)
Visible HTTP endpoints
GET itunes.apple.com/lookup- parameters: bundleId, country